# Autogenerated by Sphinx on Wed Aug 19 12:50:32 2020

Ensure :file:`python3.dll` is loaded from correct locations when Python is

embedded (CVE-2020-15523).

CVE-2020-14422: The __hash__() methods of ipaddress.IPv4Interface and

ipaddress.IPv6Interface incorrectly generated constant hash values of 32 and

128 respectively. This resulted in always causing hash collisions. The fix

uses hash() to generate hash values for the tuple of (address, mask length,

network address).

Disallow CR or LF in email.headerregistry.Address arguments to guard against

header injection attacks.

Disallow control characters in hostnames in http.client, addressing

CVE-2019-18348. Such potentially malicious header injection URLs now cause a

InvalidURL to be raised.

CVE-2020-8492: The :class:`~urllib.request.AbstractBasicAuthHandler` class

of the :mod:`urllib.request` module uses an inefficient regular expression

which can be exploited by an attacker to cause a denial of service. Fix the

regex to prevent the catastrophic backtracking. Vulnerability reported by

Ben Caller and Matt Schwager.

Newline characters have been escaped when performing uu encoding to prevent

them from overflowing into to content section of the encoded file. This

prevents malicious or accidental modification of data during the decoding

process.

Fixes a ReDoS vulnerability in :mod:`http.cookiejar`. Patch by Ben Caller.

Avoid infinite loop when reading specially crafted TAR files using the

tarfile module (CVE-2019-20907).

Use 3072 RSA keys and SHA-256 signature for test certs and keys.

:class:`~urllib.request.AbstractBasicAuthHandler` of :mod:`urllib.request`

now parses all WWW-Authenticate HTTP headers and accepts multiple challenges

per header: use the realm of the first Basic challenge.